Hello team, I have a HF in place and it is supposed to listen to a UDP port and forward the data to the indexer. Its confirm the netstat shows UDP port open and also network Team confirms for the port receiving data. But the splunk below configurations are not successful:
/opt/splunk/etc/system/local/inputs.conf
[udp://1049]
index=abc
sourcetype=efg
disabled = 0
outputs.conf
having indexer conf
splunkd.log shows only one entry for port as
INFO TcpInputProc - Closing raw IPv4 port 1049
Please help on this to make the instance listen to UDP port.
↧